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The measurement-device-independent quantum key distribution (MDI QKD) was proposed to make BB84 
completely free from any side-channel in detectors. Like in prepare & measure QKD, the use of other 
protocols in MDI setting would be advantageous in some practical situations. In this paper, we consider 
SARG04 protocol in MDI setting. The prepare & measure SARG04 is proven to be able to generate a key up 
to two-photon emission events. In MDI setting we show that the key generation is possible from the event 
with single or two-photon emission by a party and single-photon emission by the other party, but the 
two-photon emission event by both parties cannot contribute to the key generation. On the contrary to 
prepare & measure SARG04 protocol where the experimental setup is exactly the same as BB84, the 
measurement setup for SARG04 in MDI setting cannot be the same as that for BB84 since the measurement 
setup for BB84 in MDI setting induces too many bit errors. To overcome this problem, we propose two 
alternative experimental setups, and we simulate the resulting key rate. Our study highlights the 
requirements that MDI QKD poses on us regarding with the implementation of a variety of QKD protocols. 



The security of quantum key distribution (QKD) can be guaranteed based on some mathematical models of 
the users' devices^ ^ Unfortunately, the actual devices do not necessarily follow mathematical models, and 
we need to close the gap (side-channel) between the actual device and the mathematical model to implement 
secure QKD systems in practice. Among side-channels, the side-channel of a photon detector seems to be most 
easily exploited by an eavesdropper (Eve) since it accepts any input from Eve who can generate an arbitrary optical 
state such that it causes an unexpected behavior in the detector. In fact, the famous bright-pulse illumination 
attacks are based on side-channel in detectors'*. In order to countermeasure such attacks, measurement-device- 
independent (MDI) QKD^ was proposed to make BB84^ free from any possible side-channel in a detector. We 
note that MDI QKD for continuous variable was proposed by^'^. In MDI QKD, Alice and Bob do not perform any 
measurement but only send quantum signals to be measured by Eve. Therefore, bit strings generated by Alice and 
Bob are free from side-channels in photon detectors since they do not employ photon detectors. Since its 
invention, MDI QKD has been actively studied both theoretically^"*^ and experimentally*^"*^. 

As is the case in prepare & measure scheme, implementation of protocols other than BB84 in MDI setting could 
be suitable for some practical situations. In fact, many experiments for non-BB84 type prepare &: measure 
schemes, including B92*^, DPS QKD*^, coherent one-way protocol*^, SARG04^°, etc, have been reported^*. 
Therefore, it is useful in practice to use non-BB84 type protocols in MDI setting, and in this paper we consider 
to use SARG04 protocol in MDI setting, which we refer to as MDI SARG04. SARG04 was originally proposed to 
make BB84 robust against photon number splitting (PNS) attacks^^'^^ just by changing the classical post-proces- 
sing part in BB84. It is proven that SARG04 can indeed generate a key from two-photon emission event by Alice in 
addition to single-photon emission event^^'^^ showing robustness against PNS attack in some parameter regimes. 
Note in MDI setting is that both Alice and Bob are the sender of the signals, and as a result, the information 
leakage from the signals seems to be larger than the one in prepare & measure setting. Therefore, it is not trivial 
whether both single and two-photon emission events can contribute to the key generation or not. Our work 
answers this question, and we have found that the single-photon emission event by both Alice and Bob, or single- 
photon and two-photon emission by each of Alice and Bob can contribute to generating a key, but two-photon 
emission by the two parties cannot make the contribution when a probability of Eve's announcement of the 
successful measurement for the two-photon emission event is smaller than 1/16. 
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Another important issue to be addressed in MDI setting is what 
kind of measurement setup should be implemented experimentally 
at Eve's laboratory. Naively thinking, as SARG04 differs from BB84 
only in the post-processing part, the same measurement setup for 
MDI BB84 should also work for MDI-SARG04 protocol. On the 
contrary, however, it turns out that the measurement setup for 
MDI BB84 results in high bit error rate when applied to MDI- 
SARG04 protocol, and consequently, no significant key can be gen- 
erated. To generate a key in practice, we propose two alternative 
measurement schemes for the MDI-SARG04 protocol, and simulate 
the resulting key generation rate. 

Results 

MDI-SARG04 QKD protocol. In this section, we introduce the MDI- 
SARG04 QKD protocol. First, we summarize the assumptions and 
mathematical definitions made in this paper, and then we describe 
how the protocol runs. 

Assumptions and definitions. We assume that each of Alice and Bob 
has a phase randomized photon source, i.e. the vacuum, a single 
photon, and multi photons are emitted probabilistically. The prob- 
abilities of the n-photon emission from Alice and Bob arep„ andp„', 
respectively, which satisfy ^^^pn = 5^^'^^' ^ ^' encode the bit 
information in polarization of photons, and we assume that the 
preparation of the polarization is precise without any flaw. For sim- 
plicity, we consider the asymptotic case to neglect any statistical 
fluctuation, i.e., the number of the signals sent by Alice and Bob is 
infinite. In our paper, horizontal and vertical polarization states of a 
single photon are represented by Z-basis qubit states, namely |0^) and 
ll^), respectively. We also define X (rectilinear) -basis states as 

\ix) = + ( — / a/2 for / = 0, 1. By using a creation oper- 
ator Oq for a single photon in a polarization 0 and the vacuum state 
|vac), we denote an n-photon number state with polarization 0 by 

\ne) = (^Oq^ I vac) ^ \fn\. (note that when the subscript ^ is z or x, it 

refers to the qubit state rather than the photon number state). Other 
definitions we use are as follows: |^/) = cos(7i/8)|0;c) + ( — 1)' sin(7i/ 
8)|l;,)for/ = 0, 1 and \(p>) = sin(7i/8)|0;,) + (-1)'"' cos(7r/8)|l;,) for / 
= 2,3.R = exp(-7i/2Y), where Y = -/|O^XlJ + /|l^XOj, which 

satisfies RalE:^=al^^^^^^^^ for all /. = {\0,1,) ±\1A)) / Vl 
and |(^ + > = {\0A) + / V2. We denote P(-) = (•)(-)^. 

The protocol of the MDI-SARG04 QKD. The protocol runs as follows: 

(al) Alice and Bob choose a bit value / and /' (/, /' = 0, 1), respect- 
ively, and they encode the bit value into the photonic states of 
their pulses as ^ pn \ n^p. ) ( n^p. | and , pn' \ n' ^p., ) ( n' (p., | . 

(a2) Alice and Bob rotate the polarization oitneir pulses by applying 
rotation Ry^ and % with randomly- chosen values of A;( = 0, 1, 2, 
3) and A:'( = 0, 1, 2, 3), respectively, where R^ is defined by R^ = 
R^. After the rotation, Alice and Bob send the pulses to Eve's 
measurement unit (MU) through quantum channels. 

(a3) Eve performs a measurement on the incoming pulses and 
announces to Alice and Bob over the authenticated public 
channel whether her measurement outcome is successful or 
not. When the outcome is successful, she also announces types 
of the successful events, either Typel or Type2. 

(a4) Alice and Bob broadcast k and k\ over the authenticated public 
channel. If the measurement outcome in (a3) is successful with 
Typel and k = k' = 0,...,3, they keep their bit values / and /' in 
(al), and AUce flips her bit. If the measurement outcome in (a3) 
is successful with Type2 and k = k' = 0, 2, they keep their bit 
values / and /' in (al). In all the other cases, they discard their bit 
values. 



(a5) Alice and Bob repeat from (al) to (a4) until the number of the 
successful events with rotation k = k' = 0, 3 in Typel 
becomes Ni and k = k' = 0, 2 in Type2 becomes Let 
NiQf^ be the number of the successful detection event of 
Type /. Alice and Bob announce randomly- chosen N/Qf bits 
over the authenticated public channel, where C is much smaller 
than 1, and estimate the error rate ef^ in the remaining code 
bits. The estimated number of the bit error in the code bits is 
denoted by ef'NiQf{l-C). 

(a6) Alice and Bob perform error correction and privacy amplifica- 
tion on the remaining NiQf^ — bits by their discussion 
over the public channel. As a result, they share a final key of 
length GMl - C) + G2iV2(l - 0- 

At Eve's MU in (a3), honest Eve performs the Bell measurement in 
order to establish quantum correlations between Alice and Bob to 
generate the key. In Fig. 1, the experimental setup for the Bell mea- 
surement is depicted. It employs a half beam splitter (BS), two polar- 
ization BSs (PBSs), and the photon detectors. In the case where both 
Alice and Bob emit a single photon, the simultaneous photon detec- 
tion events matching the pattern Typel (Type2), listed in Table I, 
corresponds to the detection of|i/^")(|i/^^)). We emphasize that in the 
security proof we assume that Eve is malicious and has a control over 
the quantum channels, and all the bit errors are attributed to the 
consequence of the eavesdropping. 

Limitation of the experimental setup. In prepare & measure setting, 
the SARG04 protocol is different from the BB84 protocol only in the 
post-processing part, i.e., no modification is needed in the 
experimental setup. In the MDI setting, however, the experimental 
setup for the BB84 protocols^ cannot be directly used in MDI- 
SARG04 as it induces a high bit error rate, and this is a significant 
qualitative difference of MDI setting from prepare & measure setting, 
implying that not all the prepare & measure QKD protocols cannot 
be directly converted to MDI setting. Therefore, we need to consider 
an alternative experimental scheme for MDI-SARG04. In this 
section, we first discuss why the setup for MDI-BB84 gives the 
high bit error rate, and then we propose alternative experimental 
schemes for MDI-SARG04. 

For the explanation we denote by F^" ""^ the joint probability that 
Eve receives n and m photons from Alice and Bob, respectively, and 




BS : 





Decoy l-M 










Photon source 







Decoy l-M 






Rk' 




Photon source 





Alice 



Bob 



Figure 1 | Schematic of an experimental setup for the MDI-SARG04 

QKD. The role of Eve's measurement unit (MU) is to perform entangling 
operation on the photons from Alice and Bob, which is implemented by 
using a half beamsplitter (BS) followed by polarization BSs (PBSs) and 
photon detectors. We note that the PBS passes the photons in 45° 
polarization and reflects the photons in —45° polarization. 



SCIENTIFIC REPORT: | 4 : 5236 | DOI: 1 0.1 038/srep05236 



2 



Table I | Twotypesof the successful events announced by Eve's ML). 
Typel is the coincidence detection events of Dld&Drd or Drd&Dld 
denoted in Fig. 1 . Type2 is the coincidence events of Dld&Dld or 
Drd&Drd. When the successful events are Typel and Type2, Alice 
and Bob distill the states | ij/') and | ij/^), respectively, in the virtual 
protocol. 



successful event 



output 



Typel (Dld&Drd or Drd&Dld) 
Type2 (Dld&Dld or Drd&Drd) 



(a) 



(b) 



obtains the successful measurement outcome. Note that while we do 
not deal with the types of Eve's successful outcomes separately, the 
following discussion is valid for both types. For simplicity, we neglect 
all the losses, including those in the quantum channel and the photon 
detectors, and therefore we can also regard F^" ""^ as Q^" '"), which is the 
joint probability that Alice and Bob respectively emit n and m 
photons and Eve obtains the successful measurement outcome. 
Like in the MDI-BB84 protocols, we assume that Alice and Bob 
use a phase randomized weak coherent light whose average 
photon number is much smaller than 1. Thus, we have 

Q(^'^) y/2-Q(2'°)-Q(°'2)>Q("'"^) for n + m > 3. For simplicity, 

we assume Eve is honest, namely the bit error rate for n = m = 1 
is zero, and all photon detectors have unit quantum efficiency and no 
dark counting. In the following, we show that even with this simpli- 
fication favorable to Alice and Bob, no significant key is expected. To 
see this, we consider the bit error rate, and the total bit error rate e^°^ is 
expected to be 

q(2,0) (2,0) ^(0,2) (0,2) 
tot ^ %it ^bit /-|\ 

Q(i'i) + Q(2^o) + Q(0'2) ' 

where e^^f^'' is the bit error probability under the condition that Alice 
emits n photons and Bob emits m photons, and Eve announces the 
successful outcome. Note that equation (1) holds in both the MDI- 
BB84 and MDI-SARG04 protocols. It is clear from equation (1) that 
the bit error is caused by the case where one party emits two photons 

and the other party emits the vacuum. It is also clear that e^^f'' cannot 
be zero since the vacuum emission carries no bit information. In the 
case of MDI-BB84, this event is always discarded from the sifted key, 
and consequently the bit error rate in the key generation basis, i.e., 
rectilinear basis, is zero. This is so because the two-photon states 
|245 ) and |2_45o), which contribute to the bit values, are orthogonal 
and they never produce the successful outcomes in Eve's projection 
measurement for the basis { 1 0^^), 1 1^^)}. Therefore, in the experiment of 
MDI-BB84, the bit error rate is very small. In the case of MDI- 
SARG04, however, two states |2^o) and |2^i) consisting bit values 
are not orthogonal. This means that the two-photon emission con- 
tributes to the successful outcome. More precisely, 

holds from the direct calculation of 



^tot^ (0,2) A ^0.25 



,(2,o)_^(o,2)_Q^3 Note that Q(^'^V2 



•^bit 



and e'' 



0.25 



hold for any linear loss transmittance channel. Therefore, we con- 
clude that the use of the phase randomized coherent light source 
gives no significant key in MDI-SARG04. In order to generate a 
key in the MDI-SARG04 protocol. Eve's MU or the photon sources 
should be modified such that the probability of obtaining the suc- 
cessful outcome due to the two photons and the vacuum state is 
suppressed. In order to suppress the probability, we propose two 
experimental setups: (i) Eve performs quantum nondemolition 
(QND) measurement on the two incoming pulses from Alice and 
Bob just before mixing them as shown in Fig. 2(a). The QND mea- 
surement discriminates whether the photon number in the pulse is 0, 



Eve's MU 




QND 




QND 





SPDC 




Figure 2 | Two experimental setups for generating the key in the MDI- 
SARG04 protocol. Both setups significantly eliminate the events caused by 
(fly m) = (2, 0), (0, 2) and other problematic photon number 
configurations, (a) Eve performs the QND measurements on the pulses 
from Alice and Bob, and she does not perform the interference 
measurement for /7 > 2 or m > 2. Eve accepts only when n < 1 and m < 1 
are satisfied, (b) A quasi single-photon source used by Alice and Bob, 
which is composed of the heralded SPDC process. When detector Dq clicks, 
Alice/Bob sends her/his pulse at the remaining mode to Eve's MU. 

1 or more. Eve accepts only the case where n < 1 and m < 1 and 
discards the other cases with multiple photons. Thanks to the QND 
measurement, the total bit error rate is suppressed even if the phase 
randomized coherent light is used as a photon source, (ii) Without 
the modification of Eve's MU, Alice and Bob replace the phase ran- 
domized coherent light by a heralded single photon source based on a 
spontaneous parametric down- conversion (SPDC) and a threshold 
photon detector (see Fig. 2(b)). This dramatically reduces the prob- 
abilities of the events of (n,m) = (2, 0) and (0, 2). We will show that 
these setups enable us to generate the key later. 

Security proof. In this section, we discuss the unconditional security 
proof {i.e., the security proof against most general attacks) of our 
scheme. The security proof is independent of the specific device 
models like in Fig. 2, namely it is valid for any Eve's MU and any 
photon sources of Alice and Bob. Our proof employs the security 
proof based on the entanglement distillation protocol (EDP)^'^^, 
where the distillation of is considered for Typel and that of 
is considered for Type2. The proposed EDP-based virtual 
protocol, which is equivalent to the MDI-SARG04 QKD from 
Eve's viewpoint, runs as follows. 



(VI) Alice and Bob 



prepare 



I^^("^)'W)ai(Bi),A2(B2)' 

^^^-l^-+.>rj/^ for 



where 



r = 

A,B. Here k{ = 0, 1, 2, 3) and k'{ = 0, 1, 2, 3) are randomly 
chosen. The probability distribution of the photon number is 
equal to that of the photon source in the actual protocol. Alice 
and Bob send the n and m photon states in A2 and B2 to Eve's 
MU, respectively. 
(V2) Eve performs a measurement on the photons coming from 
AHce and Bob, and announces to them whether the measure- 
ment is successful (including the type of the event) or not. If the 
measurement result is not successful, AUce and Bob discard 
their qubits. 

(V3) Alice and Bob broadcast the labels k and k\ respectively. In the 
cases ofk = k' = 1,3 with the announcement of Type2 or A; 7^ 
k', Alice and Bob discard their qubits. 

(V4) Alice and Bob repeat (vl) - (v3) many times until the number 
of the successful events for k = k' becomes Ni for / = 1,2, where 
/ corresponds to the type of the events. 

(V5) Let NiQf^ be the number of the successful detection event for 
Type /. Alice and Bob announce randomly chosen NiQf^C- 
photon pairs over the authenticated public channel, where C 
is much smaller than 1, and then they perform Z-basis mea- 
surement on their qubits of the chosen pairs. By sharing their 
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measurement results over the authenticated pubhc channel, 
they estimate the bit error rate on the code qubits denoted by 
e^^^. As a result, the number of the bit error is estimated to be 

(V6) They estimate the upper bound on the phase error rate ef^^^ 
for n and m photons from the bit error rate ef^^^ for n and m 
photons. Here the phase error is defined by the bit error that 
would have been obtained if they had measured the qubit pairs 
by X basis, which is the complementarity basis of the computa- 
tional basis. 

(V7) When the bit and the phase errors are smaller than a threshold 
value for entanglement distillation, they perform the distil- 
lation for Ar/Q5°^(l — Q qubit pairs. For the cases of Typel 
and Type2, they distill the photon pairs in states and 
respectively. We denote the number of the distilled max- 
imally entangled qubit pairs as GiNi(l — Q. Finally, by per- 
forming Z-measurements on the distilled photon pairs, they 
obtain the key. 

The important quantities in the proof is the bit and phase errors, 
and the phase error rate determines the amount of privacy amplifica- 
tion. The bit error rate in the code bits of the virtual protocol, which is 
exactly the same as the one of the actual protocol, is directly esti- 
mated by test bits. On the other hand, the phase error rate is defined 
by the complementary basis X, which Alice and Bob never employ, 
and therefore this rate is not directly estimated in the protocols. Note 
that we are allowed to work on Alice's n -photon emission and Bob's 
m-photon emission separately, because Alice's and Bob's photon 
sources in the protocols are phase randomized. In the following 
subsections, we present the estimation of the phase error rates for 
the cases of Typel and Type2 independently. We derive an upper 

bound on the phase error e^^^^ for / = 1,2, where the superscript (1, 
1) denotes n = m = I and the subscript represents the type of the 
successful outcome, and derive an upper bound on the phase error 

e] pj^^ . We show that in the case of n = m = 2, no key can be generated 
when the probability of Eve's successful outcome for the two-photon 
emission event is smaller than 1/16. We note that in the cases of 
either n > 3 or m > 3, Eve can perform an unambiguous state 
discrimination to one of the three-photon emission part^^'^^, and thus 
we cannot extract the key from such events, given that the channel is 
lossy enough. 

Finally, we note that given the phase error rates, Qf^ = 



E„,„Q!"''"'ander = E„,„Q: 
rate for Type / is written by^' 



(n,m) (n,m) / ^tot 



/,bit 



Q- , the asymptotic key 



+ Qp'^^|l-/z 



(2) 



.tot^/ tot^ 



Here h{x) 
entropy. 



-X log2 X — {1 — x) log2(l — x) is the binary shannon 



phase error estimation for (n, m) = (1, 1) and (1, 2). By the analysis 
based on the virtual protocol, we give the phase error estimation 
formula for (n, m) = (1, 1) and (n, m) = (1, 2). The estimation is 
performed for Typel and Type2, separately, and we detail the deriva- 
tion of the phase error estimation in Methods section. 
In the case of Type 1, we have 



for (n, m) = (1, 1) and 



l,ph 



mm 

5l 



(3) 



(4) 



(a) 
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Figure 3 | The relations between the phase error rates and the bit error 
rates (a) for {n, m) = (1, 1) and (b) for {n, m) = (1, 2). 



for (n, m) = (1, 2), where 



/(5i)=- 

In the case of Type 2, we have 

(1,1) 



3-2si + a/6-6a/2si+4s? 



e^ ' ^<3e^'''^ 



for (n, m) = (1, 1) and 

(1,2) . f (1,2) , / 



(5) 
(6) 
(7) 



for (n, m) = (1, 2), where ^(52) is the maximal solution of the fol- 
lowing equation for x 

4a/2x^ + 2 (^1 - 3a/2 + 3a/2s2) 

+ 2(^-1 + V5+(^1-3\/2)s2 + a/2s^)x (8) 
+ (^\/2 - 1) S2 + (1 - V2^ si = 0. 

We depict the dependencies of the phase error rates on the bit error 
rates in Fig. 3. 

Impossibility of generating a key from n = m = 2. For the case oin = 
m = 2, the key cannot be obtained iox n = m = 2m Typel and Type2 
by giving an explicit Eve's attack which give a phase error of 0.5, as 
long as the success probability of Eve's measurement conditioned 
that both Alice and Bob emit two photons is not larger than 1/16. We 
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Figure 4 | The key rate when Ahce and Bob use coherent pulses and Eve 
performs non-destructively exclusion of the multi-photons from Alice 

and Bob. (a) Bottom: the key rate of the MDI-SARG04 protocol from (n, 
m) = (1, 1) only. Middle: the key rate of the MDI-SARG04 protocol from 
(n, m) = (1, 1), (1, 2) and (2, 1). Top: the key rate of the MDI-BB84 
protocol, (b) The upper and lower solid lines are the key rates from (n, m) 
= (1, 1), (1,2) and (2, 1) forTypel and Type2, respectively. The upper and 
lower dashed lines are the key rates from (n, m) = (1, 1) for Typel and 
Type2, respectively. 

show the proof in Methods section. We will prove that we cannot 
generate a key from n = m = linthe virtual protocol, and it follows 
that we cannot generate a key from n = m = 2in the actual protocol 
either. To see this, note that the virtual protocol differs from the 
actual protocol only in the way to prepare the state, and the state 
prepared and post data-processing are exactly the same in both 
protocols. In other words, only the local operation needed in state- 
preparation process by the legitimated parties are different in the two 
protocols. By recalling that any local operation cannot convert a 
separable state into a non- separable state, we conclude that if we 
cannot generate a key from a virtual protocol, then we cannot gen- 
erate a key from the actual protocol. 

Simulation. Here we show the results of the key generation rate for 
the two experimental setups as shown in Figs. 2(a) and (b) by using 
typical experimental parameters taken from Gobby-Yuan- Shields 
(GYS) experiment^", where the quantum efficiency and the dark 
counting of the all detectors in Eve's MU are rj = 0.045 and d = 
8.5 X 10"^, respectively, the loss coefficient of the quantum channel 
is^ = 0.21 dB/km, and the inefficiency of the error correcting code is 
1.22. In the simulation, we use infinite number of decoy states^^ in 

order to obtain Qp'^\ 4hit' QP'^'' 4\>it • Assuming that the bit 
error is stemmed only from dark countings of the detectors, we 
ignore the other imperfections such as the misalignment of the 
devices. We also assume that the mean photon numbers of the 
signal pulses prepared by Alice and Bob are the same, and the MU 



1.2 




0 50 100 150 200 250 

distance (km) 

Figure 5 | The optimal mean photon number for the key rate in Fig. 4. For 

the key rates from (n, m) = (1, 1), the three lines show the mean photon 
number when we consider only Typel , both types and only Type2 from the 
top. The mean photon numbers for the key rates from (n, m) = (1,1), (1,2) 
and (2, 1) show a similar tendency. The dashed line is for the MDI-BB84 
protocol. 

in Eve is the middle of Alice and Bob. The mean photon number for 
the signal is optimized for maximizing the key generation rate at each 
distance. By using equation (2) with the above parameters and 
assumptions, we calculate the key generation rate as a function of 
the distance between Alice and Bob (i) when Eve postselects the 
events with n < 1 and m < 1 with the QND measurement as 
shown in Fig. 2(a) and Alice and Bob use the coherent pulses, and 
(ii) when Eve uses the MU in Fig. 1 and Alice and Bob use quasi single 
photon sources prepared by the SPDC in Fig. 2(b). 

Case (i) - The simulation result of the key rate is shown in Fig. 4(a), 
and the mean photon number which maximizes the key rate is shown 
in Fig. 5. We also plot the key rates of Typel and Type2 separately in 
Fig. 4(b). The details for obtaining these figures are shown in 
Supplementary. When the distance is zero, since there is no photon 
loss before the BS and the multi-photon emissions are excluded, the 
events of multi-photon input have no contribution to the key rate. In 
fact, in Fig. 4(a), the two key rates at zero distance obtained from only 
{n, m) = (1, 1) and from both (n, m) = (1, 1), (1, 2) and (2, 1) are 
exactly the same. When the distance becomes longer, we see from 
Fig. 5 that the contribution of the multi photons becomes larger. For 
the key rate from only (n, m) = (1, 1), the mean photon number is 
monotonically decrease because the multi-photon emissions give 
only adverse effect. On the other hand, when we extract the key 
additionally from the multi photons, the mean photon number does 
not decrease monotonically, which shows an advantage in using 
multi-photon emission. 

Case (ii) - Alice and Bob use quasi single photon sources by SPDC 
as shown in Fig. 2(b). Detector Dq is the same as that used in Eve's 
MU, namely it is the threshold detector with the quantum efficiency 
oif\ = 0.045 and the dark counting oid= 8.5 X 10"^. Eve's MU is the 
same as that shown in Fig. 1. The key rate is shown in Fig. 6. The 
details for calculating the key rates are shown in Supplementary. The 
mean photon number which maximizes the key rate is shown in 
Fig. 7. From Fig. 6, we see that the key rate only from Typel and 
that both from Typel and Type2 intersect. For the distribution dis- 
tance longer than the cross point, Type2 has no contribution of the 
key, which is shown by the blue line in the figure, and therefore it is 
better to generate a key from Typel only. From Fig. 7, we see that the 
mean photon number is very small. This is so because the use of 
larger mean photon numbers results in two-photon emission, which 
increases the bit error rate. From all the figures of the key rate, one 
sees that the key rates of MDI-SARG04 are lower than those of MDI- 
BB84. This tendency holds also for prepare & measure SARG04^^'^^, 
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Figure 6 | The key rate when AUce and Bob use quasi single-photon 
sources prepared by the SPDC and Eve's MU is the same as the circuit 
used in the MDI-BB84 protocols. In this case, the total the key is 
approximately obtained from only the case of (n, m) = (1, 1), and the 
successful events of m) = (1,2) and {n, m) = (2, 1) give little 
contribution to the key rate. This is so because the probability of the two- 
photon component in the heralded photon source is negUgibly small 
compared with the probability of the single-photon component. The lines 
are for MDI-BB84 (black), for both types (red), Typel (green) and Type2 
(blue) of the MDI-SARG04. 

and the higher phase error rates of SARG04 protocol than that of 
BB84 is the main reason of this tendency. 

Discussion 

As shown in Figs. 4(a) and 6, the key rates of the MDI-SARG04 
protocol are smaller than those of the MDI-BB84 protocol for any 
distance. This is because the phase error rate of MDI-SARG04 is 
larger than that of MDI-BB84 and the scaling of all key rates for both 
protocols linearly depend on the total channel transmittance Tab — 
TaTb between Alice and Bob thanks to an infinite number of decoy 
states^ \ where Ta(b) is the transmittance between Alice (Bob) and 
Eve. On the other hand, the scaling of the key rate of MDI-SARG04 
can be better than that of MDI-BB84 in a high loss and small error 
regime when we do not employ the decoy states in the experimental 
setup in Fig. 2(a), which one can see as follows. For the positive key 
rate, the joint probability that both of Alice and Bob emit single 
photons and those photons are detected must be higher than the 
probability of the emission of the photons satisfying n + m > 4 since 
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Figure 7 | The optimal mean photon number for the key rate in Fig. 6. 

The upper line (black) is the mean photon number for the MDI-BB84 
protocol. The lower three lines are for the key rates of the MDI-SARG04 
protocol obtained from Typel (green), both types (red) and Type2 (blue) 
from the top. 



Eve causes the detection event preferentially from the multi-photon 
events such as n + m > 4. Noting that the joint probablity is given by 
O^p^j^pL^T^T^), where ^a(b) is the mean photon number of Alice 
(Bob)'s coherent source, we have 0{iijs^iiQT^T^)^0(yii\ii^^, 
0{fi^fiBTATB):>0{fi^fil) and 0{fi^fiBTATB):>0{filfiB). These 
lead to ^^(5) ^ and we see that the scaling of the 

key rates of MDI-SARG04 is in the order of 0{tI^). By using a 
similar argument for MDI-BB84, 0{pj^fiBTAT^)^0[pj^pl) and 
0{liji^liQTpJT^)^0(^li\p.B^ must hold for the positive key rate, lead- 
ing to (9(Ta Tb) and the scaling of the key rate of 0(T\^ . As 
a result, the key rates of MDI-SARG04 is larger than those of MDI- 
BB84 in a high loss and small error regime, and this is one of the 
advantage of MDI-SARG04 over MDI-BB84. This tendency is simi- 
larly seen in the prepare & measure setting, where the key rates of 

SARG04 and BB84 scale o{t][^^ and C>(T|g), respectively'^ Note 

that implementation of the decoy state method makes the QKD 
system complicated as it requires the additional amplitude modu- 
lation, it increases the amount of classical communications, and the 
software must be modified such that it processes the data depending 
on whether the pulse is the decoy state or the signal state. Therefore, 
in some practical situations where simple implementation is prefer- 
able, MDI-SARG04 is advantageous over MDI-BB84. 

In our analysis, we have considered the asymptotic length of the 
key. It is interesting to consider the security with finite 
resources ^''^^'^^. Regarding with the analysis of the decoy state 
method with finite number of signals, we can directly apply the 
technique developed for MDI-BB84^' to MDI-SARG04 since the 
estimation of the yields and the bit error rates of the single/two - 
photon part in a particular signal/decoy state is totally independent 
of the protocol that we run, and it is solely independent on the 
intensities of the signal/decoy states. On the other hand, however, 
the phase error estimation of MDI-SARG04 is essentially different 
from that of MDI-BB84. In the case of BB84-type protocol, Alice and 
Bob directly measure both the bit and phase errors in the test bits, 
which enables them to apply the random sampling theory for the 
phase error estimation in the code bits. In the case of MDI-SARG04, 
on the other hand, the phase error is not directly measured, and it is 
estimated via symmetry, i.e., the random rotations and the filtering 
operation, as well as Azuma's inequality^^. Therefore, the phase error 
estimation is essentially different from the one in BB84-type pro- 
tocol, and we leave it for future works. 

In the conclusion, we first proved the unconditional security of the 
MDI QKD based on the SARG04 protocol. In our security proof, we 
gave the upper bounds on the phase error rate when Alice and Bob 
emit single photons and when one party emit one photon and the 
other half emit two photons. For the case of the two photon emissions 
from both parties, we proved that a key cannot be generated as long 
as the probability of success in her measurement conditioned that 
both Alice and Bob emit two photons is not larger than 1/16. Another 
important issue to be addressed in MDI setting is what kind of 
measurement should be implemented experimentally at Eve's labor- 
atory. We have shown that the measurement setup for BB84 in MDI 
setting cannot be used in SARG04 in MDI setting, and we proposed 
two measurement schemes for MDI SARG04. In the first one, Alice 
and Bob use heralded single photon sources prepared by SPDC. In 
the second one. Eve performs QND measurement on the two pulses 
coming from Alice and Bob individually. In our simulation based on 
these experimental setups, it was confirmed that these setup can 
generate a key. 

Methods 

Proof of the phase error estimation for n = m = 1. Here, we give the phase error 
estimation for n = m = I. For this, it is convenient to recall a mathematical property 
of the maximally entangled state that {h (x)M2) |(^^ )i2^ {Mi®h) |'^^ )i2 satisfied 
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Figure 8 | Schematic that is equivalent to the EDP for n = m = 1. While 
Eve accesses only the photons in modes A2 and B2 in the actual protocol, we 
pessimistically suppose that she can prepare any state in A[ and Bi for 
simplicity of the proof. 



for any operator M. Therefore |Oi^fc)^ ^ in (vl) is expressed as |Oi^fc)^ ^ oc 
^iXKx 1*^^ )a;a.' ^here F^^^; = cos(n/8)|0,>^^ (0,|^; + sin(n/8)|l,'>I^ 
Physically, this identification can be interpreted as the situation where |(^"^> is 
prepared by each of the parties, the filtering operation, of which successful case is 
described by Fi, is applied, and then each party sends the photons to Eve only when 
the filtering operation succeeds (also see Fig. 8). For the simplicity of the security 
proof, we make an overestimation of Eve's ability in terms of the accessibility of the 
photons, namely, we imagine Eve who has a direct access to photons of Ai and B[ 
rather than A2 and B2, and she can prepare any joint state of the photons of Ai and Bi . 
For later convenience, we denote by Pa^bJisuc the state prepared by Eve. 

In the following, we first discuss the case of Type 1. We define 
^l!b!t/ph =tr(nS;{,;t/ph^!iB!|suc) the joint probability that the photons in pj^'^j |^^^ 
pass through the filtering operation and induces a bit/phase error to the state 
after the rotation. Here TL[^^^ and Tl[^'^^ are POVM elements of the bit and phase 
error measurements on pj^! g? |^^^, respectively. The probability that the two photons in 



^A'lB'ilsuc 



pass through the successful filtering operation is described by 



=tr n' 



(1,1) 

,fil ^A'lBils 



, where the POVM element of the successful filtering 



operation on the two photons is 



(9) 



where P{') = (OC*)^- The POVMs for the bit and the phase errors are written as 

nS;b!./ph= jEEf'KAif.'Ai \h/,)^RmPlB', \h/,}sX (10) 



Applying the Bayes' rule, the bit error rate e[^^^ and the phase error rate e[^^^ in the 
final state in modes Ai and B^ are described by 



(1,1) ^ ^l,bit/ph 
^l,bit/ph (1,1) • 



(11) 



The phase error estimation can be established by directly writing down the explicit 
form of equation (10) comparing each matrix element, and one can conclude that 



n 



(1,1) _ 3 (1,1) 

l,ph J ^^l,bit • 



(12) 



Thus from equations (9) and (11), the phase error rate is precisely estimated, by using 
the bit error rate, as shown in equation (3). Thanks to Azuma's inequality^^, equation 
(3) holds for any eavesdropping including coherent attacks. 

Next, we estimate the phase error rate for Type2. Because only the cases ofk = k' = 
0, 2 are accepted for Type2, the definition of the POVM element of the successful 
filtering operation is changed to 



n2!m=jE^'(«'<.Ai^i';Ai«Mif?;Bi)> 



(13) 



^ k=oa 



and the probability that the two photons in Pajb?|suc P^^^ through the successful 
filtering operation is expressed byp2m^ ^^^(j^^i 'fli Pa:iB\\suc) • describe a joint 
probability that the two photons in PaibJis^c P^^^ through the successful filtering 
operation after the rotation and then the photons in modes Ai and Bi have a bit/phase 
error to the state | iA+> by 4!b!t/ph = (n2|b!t/ph)^Ai b! |suc) • ^ike in the case of Typel, the 
POVM elements of Tl^2h^ ^2 are written by 



n2!bU = ^E E ^'(«tAlf,!All''.)A «Wlfl!Bl|i®l.)B, 



(14) 



and 



Eve 
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A2 



B2 |<^+) B^i 



A'l 
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Measurement 



Figure 9 | Schematic which is equivalent to the EDP for n = I and m = 2. 

By Eve's announcement for the successful measurement on the photons in 
A2, B2 and B4, the three-photon state PAiB'iB'slsuc prepared. 



n2!ph = 2E E p{R^.MpU\i')AWl<^,\QB 



(15) 



By using the Bayes' rule, the bit/phase error rate of ^^^^pj^ 
expressed by 



in the final state is 



(1,1) 

^2,bit/ph ' 



g(l,l) 
^2,bit/ph 

^(1,1) • 



(16) 



In order to see the relation between the bit and phase error rates, we consider an 
inequality to bound the phase error as 5^2 bit ~ ^2 ph — ^' ^here s is a real number, 

,(14) . 



which is equivalent to 5n2'{,J/ — n2^pj^^ > 0 for ^2^^^'' > 0. By considering a non-neg- 
ativity condition of 5n2^,^|t ~ 1^2 ph — ^' ^^^^ ^^^^ inequality always holds when s 
> 3, and therefore, we have the relation between the phase error rate and the bit error 
as shown in equation (6). 

Proof of the phase error estimation for « = 1 and m = 2. Below, we give the phase error 
estimation for ?i = 1 and m = 2. By using the similar argument asn = m = 1, 1 02,^)3 b 
at Bob's side in (vl) is defined by {OAbA^b'.b'.RIb'RLb's \^^)b',b, \^^)b',b', ^ 9' 
where ^2316^ = cos2(n/8)|0^0,>B^B^ (O.O.Ib,^, + sin2(n/8)|0,0,>B^B^ 
(IxIxIb'iB^ + V2cos(n/8) sin(n/8)|l;cOx>BiB3('A^ Ib^w,- ^^^^ ^^^^ 
photon emission part is simulated by preparing two pairs of |0^> followed by the rotation 
and the filtering operation on two qubits (see also Fig. 9). In this virtual protocol, while we 
consider two photons in different modes, this never underestimates Eve's ability. This is so 
because two photons in the different modes and two photons in a single mode can be 
converted just by an unitary transformation as {(Pi)^^ \(Pi)Bi • 
because the photon in mode B3 is in |0j after the filtering operation, and it is decoupled 
from all the other systems, the component is not related to the security proof Again, we 
employ the overestimation that Eve has the control over the state of the systems of A 1 , B'l 
and B3, and we denote the three-photon state by Pa\b'iB^|suc' ^hich is prepared by Eve 
after her announcement of the success. Like in the case for n = m = 1, we estimate a 
phase error for each case of Typel and Type2 separately. 

For Typel, define a POVM element of the successful filtering operations on 

(1,2) 
^A'lB'iB^lsuc 



= ^E^'(«MiJ',!Ai«Wl«Mif231Bi) 



(17) 



Here the probability of the successful filtering operation is written by 



Pi,fii - 



■^^l AAi,m ^AiBiB:,|si 



. We define e. 



l,bit/ph ■ 



= tr(n||^pj^pj^;3j3,,^^J as a joint 



probability that the photons in Pa^bJb^Isuc P^^^ through the filtering operation and 
induces a bit/phase error to the state \\J/~) after the rotation, the successful filtering 
operation after the rotation is performed on the two photons in P^iBiB^isuc ^^^^ 
the photons in modes Ai and Bi have a bit/phase error to the state \ ijy~). Here, POVM 



elements of 11 



(1,2) 
l,bit/ph 



are written by 



t(1,2) 

^l,bit/ph 4 



iEE^K'^i'ai 



!z/x 



(18) 



RtBl«MiJ'2JiB:,l'./x)B,|0,>Bj. 



The actual bit error rate e[^^^ and phase error rate e^^^^ for = 1 and m = 2 are 
obtained by accommodating the normalization by p[^'f^^ , and they are expressed as 



~(1,2) 
(1,2) ^ ^l,bit/ph 
^l,bit/ph (1,2) • 

PiM 



(19) 
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Figure 10 | Schematic which is equivalent to the EDP for n = m = 2. By 

Eve's announcement for the successful measurement on the photons in A2, 



A4, B2 and B4, the four-photon state p 



,(2,2) 

'AiAaB'iB'slsuc 



is prepared. 



In order to see the relation between the bit and phase error rates, we consider an 
inequality to bound the phase error as e\ <Sie\ + h, where Si and ti are real 
numbers. By using equations (17) - (19), and the linearity of the trace, we obtain an 



inequality as Sillj^i^^^^ + fillj^^^^ — Tl\^'^^ > 0, which is satisfied when 



t(1'2) 



(1,2) . 



h >fisi)-- 



3-2si -\-^6-6V2si +4s^ 



(20) 



Therefore the phase error rate is given by using the bit error as shown in equation (4). 

For Type2, we define a POVM element 112^^^/ of the successful filtering operation 
by limiting the summation only to A; = 0, 2 and by replacing 1/4 with 1/2 in equation 
(17). The probability of the successful filtering operation is described by 

Piii =tr (n^lfJ^AiBlB^isuc) • also define joint probabilities of pJ^'b^b^i,^, passing 
through the filtering and presenting bit and phase errors to the state |i/^"^> by 



(1,2) (1,2) 



,(1,2) 



-r(i,2) 



(1,2) Jl,2) 

.'iBiB:,|si 



. We define the POVM 



element of ph lin^iting the summation only to A; = 0, 2 and replacing 1/4 with 1/ 
2 in equation (18), and that of 112^,^^^^ is defined by limiting the summation only tok = 
0, 2, replacing 1/4 with 1/2, and \ iz} with \ i ® 1^) for mode Bi. In a similar manner as 
the case of Typel for ?i = 1 and m = 2, by using the bit error rate defined by 

4lMt = ~^2M I ^2!f n ' the phase error rate as e^^'^l = ~e[]^^ j p^^fl and real numbers 

(1 2) fi 2) 

and we consider an inequality as e\ "^^^ <S2e\ + 12> which leads to 
^2n^|{2 + ^2n^|ff/ - n^l^J > O. From this inequality, we obtain ^2 — gis-^, where ^(52) 
is the maximal solution of equation (8). Using ^(52), we have the relation between the 
phase error rate and the bit error as shown in equation (7). 

Proof of the impossibility of generating a key from n = m = 2. For the case ofn = m 
= 2, like in the previous subsection, \(^2,k)Ai A2 Alice's side in (vl) is obtained by 

(0x|A3^2,AiA^^jAi^[,A^ \^^)a\a, )a^A4' \^2,k)B,,B2 ^^^'^ ^^^^ prepared by 
the same manner. As a result, the virtual protocol for n = m = lis equivalent to the 
successful situation of the filtering operations, which we depict in Fig. 10. We denote 
the state of Alice's and Bob's four qubits after Eve's successful announcement by 
^MaIb'iB^Isuc- 1^ the following, we prove that the key cannot be obtained forn = m = 2 
by giving an explicit Eve's attack, namely we give explicit states of A'l, A3, B'l and B3 
which give a phase error of 0.5. The key ingredient is that while Eve cannot 
manipulate these four qubits, she conclusively prepare such a state on their qubits by 
announcing the success of her measurement only when she succeeds an 
eavesdropping measurement on Eve's photons A2, A4, B2 and B4. This attack gives Eve 
the perfect information on the bit values when her measurement succeeds. 
For Typel, the probability of the successful filtering operation is expressed by 

p'5'=tr(n<S'p<^l!,.3,,J. where 



(21) 



The joint probability, that the filtering operation succeeds and the bit/phase error to 
the state is detected, is expressed by 



S(2,2) 



,bit/ph 



= "'(nSt'ph''AllsBlBi|suc)' where 



i = 0 k = 0 

^(2,2) 



(22) 



The bit/phase error rate is expressed as ef^^^^^ = ef^^^^^^ pfff/ . One can confirm by 
direct calculation that a four-photon state of A\B[A'iB'i = I'A" )AiB^ |Oxlx)A^Bi 8^^^^ 
^fbit ^fph =0.5, and another four-photon state 

I/^2>A1B1A^B^ = (|O^Ozl^O^>AiA^BiB^ + |l^OzOzlz>AiA^BiB0 / v^> which is orthogonal to 



1/^1 ) A'l B'l A^B^' gi^^^ ^i^Mt =0.5 and e[^'^^ =0.5. Therefore, although Eve cannot touch 
the four modes A'l, B'l, A3 and B3, Eve can prepare the two states by a projective 
measurement on the four photons in A2, B2, A4 and B4 as 



.(2,2) . 



|p(|/^i>),P(|/i2>), I - Oi^^ sees this fact from the equation 

A,B,A4B, (/^,#+ )b'iB, >A^A4 I*^^ )b^B4 = KB'.A^B', / which alsO 

implies that the preparation succeeds with a probability of 1/16. Thus a malicious Eve 
achieves the phase error rate of 0.5 for any bit error rate by distributing these states 
with a relevant probability. This means that the state in A^ and B^ is separable, and it 
follows that no key can be generated for qf'^"^ < 1/ 16, where '^^ is the probability of 
Eve's successful detection of Type / conditioned that both Alice and Bob emit two 
photons. 

For Type2, with the same fashion as the case of n = I and m = 2, POVM 
elements ^ff^i for the successful filtering operation and ^f^^/^^^ for the bit/phase 
error are defined by replacing the summation range of k, the prefactor and the proper 
inversion of the bit value of the projection in equations (21) and (22). We 
consider the following four orthogonal four-photon states for systems A'l , B'l , A3 and 

B3 |Vl>A'iB'iA^B^ = k+ )AiB'i |0^0^)mB^> I ^2 > a'i B'l A^ B^ = >a'iB'i |0^1^)a^B^' 

l^3>A'iB'iA^B^ = \^^ )a'iB'i I 1^0^)a^B^ ^^d | V4>AiB'iA^B^ = 1^" >A'iB'i |O^Ox>a^b:, " ^^^^ State 

can be prepared by Eve's projective measurement {P(|vi)),P(|v2)),P(|v3)), 

P( I V4 ) ) , I — f ^ ^ P( I V/ ) ) } on the four photons in A2, B2, A4 and B4 with a probability 

of 1/16. By calculating the error probabilities, we see that mixed states 0.25|vi>(vi| + 

O.75IV2XV2I and0.75|v3Xv3| + O.25IV4XV4I give (ef^l 4^h) =(0,0.5) and 



,(2,2) (2,2) \ 
'^2,bit ' '^2,ph i 



= (0.5,0.5), respectively. Therefore Eve achieves any bit error rate 



below 0.5 while keeping e^2ph ^ 0.5 by distributing the above two mixed states with an 

appropriate probability. As a result, we conclude that for ^2^'^^ < 1/ 16, the key cannot 
be obtained. 
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